What is a malicious signing request or wallet drainer?

The full answer

How does a malicious signing request take your XRP?

On this page, a malicious signing request means a transaction someone else prepares and asks you to approve, which moves your funds or gives them power over your account. “Wallet drainer” is the common name for scams and tools built to deliver those requests.

The XRP Ledger does not check intent. XRPL.org’s cryptographic keys page, checked in September 2026, says digital signatures are the only way to authorize transactions, and that no privileged administrator can undo or reverse a transaction after it has applied [1]. The same page says anyone who knows an account’s seed or private key can sign any transaction the owner could [1]. Reading those two rules together, a drainer that gets one valid signature from the owner ends up with the same result as one that stole the key.

Other authorities say the same about reversal. The FBI’s Internet Crime Complaint Center (IC3) says crypto transactions are irrevocable and that no third party sits between them or authorizes them [2]. The US Federal Trade Commission says crypto payments typically are not reversible, and that money usually comes back only if the person you paid sends it back [3]. Ripple says on its scam-awareness page that it cannot stop or alter transactions on the XRP Ledger [4].

Which XRP Ledger transaction types can hand over account control, such as SetRegularKey?

A payment that empties the balance is the obvious risk. Account settings can do quieter damage.

XRPL.org says a regular key pair can be removed or replaced at any time, and that a regular key or multi-signature can do anything else the master key pair can [1]. Its multi-signing page says the SignerListSet transaction defines a signer list, a set of addresses that can authorize transactions from your address [5]. That page also gives an example in which friends on a signer list multi-sign a transaction to replace an owner’s lost regular key [5].

Taken together, a sign request that sets a regular key or a signer list chosen by someone else would hand that person signing power over the account. No XRP would need to leave at the moment of approval, so the balance could look normal right afterwards. That is an inference from XRPL.org’s documentation, set out in the analysis list on this page.

The fee field is another quiet route. XRPL.org says every transaction destroys the exact amount of XRP written in its Fee field, even when that is much more than the current minimum [6]. The minimum for a standard transaction is 10 drops [6], and one drop is 0.000001 XRP [7].

How do I read an XRP Ledger sign request before approving it?

The fields below follow from the rules above. Each one is something a request can be used to change.

• Transaction type. A payment moves value. A regular key or SignerListSet transaction changes who can sign for the account [1][5].
• Destination address. The FBI’s Denver field office warned on April 26, 2024 that look-alike addresses can share the first and last characters of a familiar address while the middle differs, and advised checking the entire address [8].
• Destination tag. XRPL.org says a payment to an exchange can use a destination tag to show which customer to credit [9].
• Fee. Compare the Fee against the 10-drop minimum for a standard transaction [6].

The setting matters as much as the fields. The FBI’s April 6, 2026 release on crypto and AI scams told people to resist pressure to act quickly and to assess the situation before turning over money [10]. D’CENT says in its app FAQ that, on its hardware wallet, every transfer must be approved on the device and the phone app serves only as the interface for display and operation [11]. On that model, the device screen is the place to read a request, because the app or website that produced it may be the part an attacker controls.

Where do drainer requests come from?

Chainalysis said major scam operations became increasingly industrialized in 2025, using phishing-as-a-service tools, AI-generated deepfakes and professional money laundering networks [12].

Unexpected tokens are one entry point. Ripple lists unfamiliar crypto assets or tokens appearing in your wallet among its scam warning signs [4]. The FBI’s IC3 said on June 3, 2025 that when unsolicited airdrop tokens arrive in a non-custodial wallet, a plaintext memo can appear alongside them [13]. The page on strange tokens, airdrops and messages in an XRP wallet covers what those memos ask people to do. Look-alike addresses are a related trick, covered in the page on address poisoning.

Does a hardware wallet or air-gapped signing stop it?

A hardware wallet changes where the key lives. D’CENT says the private key on its hardware wallet stays within the device’s secure chip [11]. XRPL.org’s secure signing page says any setup in which outside sources may gain access to your secret key is dangerous and likely to end with a malicious user stealing all your XRP [14].

The limits are documented too. FINRA says hardware wallets aren’t totally immune from sophisticated hacking techniques [15]. D’CENT says that if a hardware wallet’s recovery phrase was ever entered into an app wallet or any other software wallet, the two share the same private keys and the hardware wallet should not be treated as isolated [11].

Not every drain needs a sign request at all. XRPL.org reported on April 28, 2025 that versions of the xrpl.js library published on April 21, 2025 carried malicious code built to capture secret key material and send it to an attacker’s website [16]. Reading the evidence together, offline keys and on-device approval block that key-theft route, but they cannot stop an owner from approving a harmful transaction the device displays correctly. The page on air-gapped signing sets out what fully offline signing adds, and the strongest critique of trusting devices is on the page asking whether a hardware wallet can be hacked.

I approved something suspicious; what do I do right now?

Start by finding out what was signed. The page on reading an XRP Ledger transaction on a public explorer shows where to look up the transaction type, destination and fee.

If the secret itself may be exposed, XRPL.org’s guidance after the xrpl.js incident was blunt: anyone who installed the infected versions should assume their wallets were compromised and follow its key rotation recommendations [16]. XRPL.org also says to disable the master key pair if it may have been compromised, after checking that a regular key or multi-signing list works [17]. The ledger refuses a transaction that tries to remove the only remaining way of authorizing transactions, with the result code tecNO_ALTERNATIVE_KEY [18]. XRPL.org warns that no one can restore access to an account if something goes wrong [17].

If the request changed who can sign, XRPL.org says a regular key can be removed or replaced at any time, and that a master key kept enabled but offline can still be found and used in an emergency [1]. Whether that helps depends on who now holds working keys, which is why the first step is reading the transaction.

Report it, even if nothing has moved yet. The FBI’s IC3 asks for complaints even where no financial loss occurred, with the crypto addresses, amounts and types, transaction hashes, and dates and times [2]. In Canada, the Anti-Fraud Centre’s victim page says to gather all information including emails and texts, report to the financial institution that transferred the money, get a police file number, and report to the centre online or at 1-888-495-8501 [19]. Ripple’s reporting steps include telling your exchange, custodian or wallet provider [4]. The page on reporting an XRP scam has the full list.

Expect a second approach. The Canadian Anti-Fraud Centre says fraudsters often target victims a second or third time with the promise of recovering money, and tells people never to send recovery money [19]. The FBI’s IC3 said on June 24, 2024 that anyone who contacts you claiming they can recover stolen crypto should get no money and no personal information, and that law enforcement does not charge victims a fee [20]. The page on crypto recovery scams covers how these offers work.

How common are drainers on the XRP Ledger?

No count exists for this ledger alone. As of October 1, 2026, no government agency or security firm had published a figure for wallet-drainer losses on the XRP Ledger specifically. Chainalysis estimated that about $17 billion was stolen in crypto scams and fraud in 2025 [12], a total for scams and fraud in general rather than for drainers.